# FINAL Internal Audit Report

## Banking and Payment Arrangements – Accounts Payable (AP)

**October 2019**

| To: | Director of Finance, LBB\
| | Acting Head of Finance – Projects, LBB | | Copied to: | Finance Director, CSG\
| | Accounts Payable Manager, Accounts Payable, CSG\
| | CSG/LBB AP Business Partner\
| | Deputy Director of Finance, LBB\
| | Assistant Director of Finance, LBB\
| | Accounts Payable Senior Manager, CSG\
| | Accounts Payable Team Leader, Accounts Payable, CSG\
| | Operations Director, CSG\
| | Head of Performance and Risk Management, CSG | | From: | Head of Internal Audit LBB |

We would like to thank management and staff of the Accounts Payable team for their time and co-operation during the course of the internal audit. Contents

Executive Summary

1. Progress against relevant actions from Grant Thornton’s ‘Review of the Financial Management Relating to CPO Fraud’ (Page 6)

2. Accounts Payable audit - Findings, Risks and Action Plan (Page 16)

3. Appendix 5: Follow-up of past audits – Accounts Payable 2017-18 (Page 39)

4. Appendix 6.1: Outcome of detailed testing from Payments Data Analytics and Matching Exercises’ reported in February 2019 (Page 43)

5. Appendix 6.2 Observations from Payments Data Analytics and Matching Exercises’ reported in February 2019. (Page 54) Executive Summary

| Assurance level | Number of recommendations by risk category | |-----------------|------------------------------------------| | Limited Assurance | Critical | High | Medium | Low | Advisory | | | - | 2 | 4 | 1 | - |

Scope

This review was undertaken as part of the 2018-19 Internal Audit and Anti-Fraud Strategy and Annual Plan approved by the Council’s Audit Committee on 19 April 2018.

The Council’s Accounts Payable function is run by the Customer Support Group (CSG), a Capita function based in Chichester on behalf of the Council. This review identified the key controls over payments made by the Council (outside of the Treasury team) and tested the operation of processes to give assurance on the effectiveness of those controls. See Part 2 of this report for the outcome of the testing of key Accounts Payable controls.

In December 2017, it came to light that potentially fraudulent transactions of ca. £2m had been made against the Council. An investigation was opened by the Council’s Corporate Anti-Fraud Team (CAFT) and it was found that the transactions related to Compulsory Purchase Orders (CPOs). As a result of the alleged fraud the Chief Financial Officer (CFO) commissioned Grant Thornton (GT) UK LLP to undertake a review of the governance and financial control environment surrounding regeneration projects. In total, 32 recommendations were raised to enhance the financial control environment at the Council. As part of this audit we sought to verify that actions related to Accounts Payable from the Grant Thornton ‘Review of the Financial Management Relating to CPO Fraud’ have been completed and associated processes are now being complied with. The outcome of this testing is contained within Part 1 of this report.

The review also incorporated the outcome of the separate ‘Payments Data Analytics and Matching Exercises’ reported in February 2019. This included an assessment of whether any further fraudulent payments had been made – to date no further fraudulent payments were found. See Appendix 6 of this report.

Finally, we also followed up audit actions from previous audits in this area. See Appendix 5 of this report.

Due to the far-reaching nature of this review, incorporating the response to the GT action plan, the fieldwork has been undertaken over an extended period from September 2018 to July 2019.

Summary of findings

1. Grant Thornton review – outstanding actions, GT15 and GT16, relevant to AP

GT15 **GT Recommendation:** We recommend that the BACS process be reviewed for the adequacy of controls over new suppliers where there is no purchase order (such as E-form payments).

**Implemented**

For GT15, segregation of duties is now embedded in non-PO payments as follows:

- API E-Form payments authorised by budget manager and independent payment checks (AP) for non-PO (purchase order) OTV (One Time Vendor) and non-PO, non-OTV payments;
- supplier creation / supplier change requests (Service), related independent checks (AP) and related creation/change (CST, IT Integra Support Team) in Integra;
- the separate authorisation of non-API non-PO payments; and
- the provision of adequate supporting documentation for all non-PO payments.

Non-PO API payments are now governed by fit for purpose documented procedures which have been implemented. An API Exemption list has also been completed defining the types of payment and documentation that are exempt from the standard PO route.

**GT 16**

**GT Recommendation:** The Masterfile supporting the BACS payment process does not automatically identify and flag payments made to different suppliers/recipient that had the same bank account number.

**Implemented**

For GT16, the New Supplier and Supplier Amendment Process which has been implemented will:

- mitigate the risk of fraudulent changes to bank details in the manner perpetrated in the recent fraud; and
- mitigate the risk of the creation of fraudulent suppliers with the same bank account.

The creation of new suppliers and changes to vendor bank details are now done by E-Form, the process is segregated and is subject to independent checks by AP prior to update in the system by ICT.

**2. Accounts Payable audit**

This audit has identified 2 high, 4 medium and 1 low risk rated finding relating to the control design and operating effectiveness of the controls in place over Accounts Payable as follows: • **Authorisation of Purchase Orders (POs) (High):** We found that there was no reporting and review process for dual authorisation of purchase orders above £1m as required by the "Dual Authorisation for Payments over £1million Process Note V1.0". For 2/15 purchase orders tested, the related dual authorisation of the purchase orders above £1m was not attached in Integra as required.

• **Manual upload process (High):** Payments, recently to the value of £101m annually, are made through Integra using a manual upload process defined in a process document "Manual Upload BACS Payments Process V1.0". The related process document is not clear as to the type of payments which may be made through the manual upload process and the schedule of manual payment authorisers, referred to in the document, was out of date as it referred to officers who had left the Council/Capita.

• **Duplicate payments (Medium):** Arrangements to identify potential duplicate payments (non-PO and PO) using software, AP Forensics, searching by payment parameters such as value and payee name were in progress, however had not been implemented despite discussions being ongoing since 2018. There was evidence of an existing process being possible identifying duplicate payments, however this had only been run once pending implementation of the new software.

• **Missing supplier invoice (Medium):** In 1/10 (10%) instances of our testing of standard PO payments, the invoice was not attached in Integra when the audit test was done. The invoice was subsequently found to be attached in Integra however only on 26 June 2019, a significant period after it was cleared 5/12/2018 for payment in Integra. We would have expected AP to reject a payment without a supporting invoice.

• **AP training and development (Medium):** CSG Management indicated that a programme of training and development existed for the CSG AP team. The programme involved AP officers completing a training needs assessment in which they recorded their understanding of various related procedure documents. Gaps noted in what they recorded, as compared to the content and purpose of the document, informed their training. We do not have an issue on the design of the process. However, evidence of its operation had been requested by Internal Audit but had not been provided for our review. We can therefore not provide assurance over the effective operation of the control.

• **AP documented procedures (Medium):** We reviewed 14 Intranet procedures relevant to AP processing, findings as follows:

- 10/14 documents were out of date and had not been reviewed or updated in more than two years.
- 4/14 documents had been updated in the course of 2018, but contained information which was out of date around the escalation route for AP Other issues and the current supplier request process.

Other key documents such as the “New Supplier and Supplier Amendment Process V1.0 (16/8/2018)” Appendix 4: “Budget Managers and Superiors” was out of date, for example, it included officers who had left the Council.

• **BACS reconciliation (Low):** Evidence of the daily BACS payment review processes was provided. However, although the process involved the review of payments over £35k and the Listing of BACS payments report was retained for referral, it was not clear how the process, by its design, could mitigate the risk of a fraudulent change(s)/alteration(s) to the BACS file after approval, the specific risk referred to in the agreed terms of reference for the audit.

3. **Follow-up of previous Audit Actions, refer to Appendix 5 for detailed findings** We followed up three recommendations made in the Accounts Payable 2017-18 audit. All actions were considered implemented/completed by 31 March 2019.

4. ‘Payments Data Analytics and Matching Exercises’ (PDAME) reported in February 2019, refer to Appendix 6 for detailed findings

At Audit Committee 22 November 2018 Members raised a query after the GT report was presented about the possibility of other fraudulent payments in Integra i.e. the possibility of similar financial failings occurring in other Services across the council. This prompted internal audit to undertake a data analytics and matching exercise for the LBB Payments Account which involved the identification of matches, for example payments to one vendor but to different bank accounts (such as in the recent fraud), which could relate to potentially fraudulent transactions in a financial environment where controls were weak. Where matches warranted further investigation in terms of being potentially fraudulent or where they highlighted poor data quality for vendor master data, they were referred to CAFT and AP for further review.

A summary of the findings relating to the data matches, referred matches and review findings are set out in Appendix 6.1.

The PDAME identified 11 datasets. Work has been completed with no issues on 5/11 datasets, with work ongoing and approaching completion on 6/11 datasets.

The data matches identified seven bank accounts that had received fraudulent payments; these were already known to CAFT as part of an ongoing fraud investigation. No further transactions reviewed to date have been found to be fraudulent.

The Data Analytics review also raised a number of Observations to be considered which are included within this report at Appendix 6.2. It has been agreed that the AP Finance Business Partner will review the observations as a basis for implementing changes in Integra, in current or future versions/updates based on a risk/cost/benefit analysis.

1. Progress against relevant actions from Grant Thornton’s ‘Review of the Financial Management Relating to CPO Fraud’

| GT Ref | Recommendation | Recommendation detail | Priority | Action | Status reported to Audit Committee 22nd November 2018 | Status reported to Audit Committee 31st January 2019 | Status verbally reported to Audit Committee May (GT16) and July (GT15) 2019 | |--------|----------------|-----------------------|----------|--------|-----------------------------------------------------|-----------------------------------------------------|-----------------------------------------------------| | GT15 | BACS Process for new suppliers | We recommend that the BACS process be reviewed for the adequacy of controls over new suppliers where there is no purchase order (such as E-form payments). | High, immediate | CSG to review process for one-time vendors, propose improvements and implement. | The process has been submitted and verified, however it has not been possible to test the operating effectiveness of this control, as the control design was not finalised in the testing period. Further testing is required | Not Implemented | Implemented |

**a. Non-PO payment including API E-Forms**

Non-Purchase Order (Non-PO) transactions include payments to:

- One Time Vendors – suppliers paid only once and
- suppliers that may be paid more than once where no purchase order is required. Where a OTV is paid more than once, the payee will now need to be created as a supplier on the Vendor Master File in Integra.

A non-Purchase Order Exemption list has been approved by Finance and communicated to Accounts Payable (AP) defining payments which are exempt from the normal purchase order process. These payments are now processed via electronic API E-forms in the Council’s accounting system, Integra. They are authorised in terms of Integra workflow which is set up to ensure approval in line with the Schemes of Financial Delegation, schemes reviewed routinely and available on the Intranet for referral. Supporting documentation matching the | GT Ref | Recommendation detail | Priority | Action | Status reported to Audit Committee 22nd November 2018 | Status reported to Audit Committee 31st January 2019 | Status verbally reported to Audit Committee May (GT16) and July (GT15) 2019 | |--------|------------------------|----------|--------|-----------------------------------------------------|-----------------------------------------------------|------------------------------------------------------------------| | | | | | | | payments must be attached with the Integra API E-Form by the Service. | | | | | | | | AP reject payments not using the Integra API E-form. They are also required to ensure that supporting documentation matches the API E-form detail, including the bank details, in terms of the API E-Form Vendor Process V1.0 and reject payments which do not comply. | | | | | | | | Evidence was provided to us confirming that Accounts Payable (AP) were undertaking the API E-Form checks for API payments they were required to undertake in terms of the “API E-Form Vendor Process V1.0” process document. Our sample testing confirmed that bank details per the supporting documentation matched the bank details in Integra. | | | | | | | | Other types of non-PO payments were also reviewed, for example those made through the ControCC and Mosaic interface – the social care systems in Family Services and Adults and Communities - into Integra. These were authorised and supported by sufficient documentation. | | | | | | | | **b. New Suppliers** |

| GT Ref | Recommendation detail | Priority | Action | Status reported to Audit Committee 22nd November 2018 | Status reported to Audit Committee 31st January 2019 | Status verbally reported to Audit Committee May (GT16) and July (GT15) 2019 | |--------|------------------------|----------|--------|-----------------------------------------------------|-----------------------------------------------------|------------------------------------------------------------------|

Where suppliers are paid more than once, a vendor account needs to be created in the Integra Vendor Master File. Creation of the new vendor or changes to the vendor details are governed by the “New Supplier and Supplier Amendment Process V1.0”. A Supplier E-Form is:

- created in the Service with supporting documentation including bank details,
- completed by AP after they have conducted detailed supplier checks in terms of the above document and then
- created in the system by ICT.

Evidence was provided to us that AP were undertaking the new supplier and change in bank detail checks they were required to undertake in terms of the “New Supplier and Supplier Amendment Process V1.0” process document. Our testing confirmed that bank details per the supporting documentation provided with the supplier E-Form matched the bank details in Integra.

**Summary**

For GT15, segregation of duties is now embedded in non-PO payments as follows: | GT Ref | Recommendation detail | Priority | Action | Status reported to Audit Committee 22nd November 2018 | Status reported to Audit Committee 31st January 2019 | Status verbally reported to Audit Committee May (GT16) and July (GT15) 2019 | |--------|------------------------|----------|--------|-----------------------------------------------------|-----------------------------------------------------|------------------------------------------------------------------| | | | | | | | - API E-Form payment authorised by budget manager and independent payment checks (AP) for non-PO (purchase order) OTV (One Time Vendor) and non-PO-non OTV payments and supplier creation / supplier change requests (Service), related independent checks (AP) and related creation/change (CST, IT Integra Support Team) in Integra - the separate authorisation of non-API non-PO payments - the provision of adequate supporting documentation for all payments. | | | | | | | | In terms of the recent fraud where the fraudster changed the bank account details of an existing master file vendor (a solicitor) to his own, this would not be possible through the AP route as the change in bank details would be subject to independent check by AP in terms of the “New Supplier and Supplier Amendment Process V1.0” | | GT Ref | Recommendation detail | Priority | Action | Status reported to Audit Committee 22nd November 2018 | Status reported to Audit Committee 31st January 2019 | Status verbally reported to Audit Committee May (GT16) and July (GT15) 2019 | |--------|------------------------|----------|--------|-----------------------------------------------------|-----------------------------------------------------|---------------------------------------------------------------------| | | | | | | | Related PDAME outcomes - refer to Part 4 for detailed findings on matches and referral findings/progress | | | | | | | | The PDAME identified matches relating to bank details that were referred to CAFT and AP for further review. | | | | | | | | 1.1 Vendors Receiving Payments into Multiple Bank Accounts (non OTV) – matched items related to low risk changes in bank sort code. Matches were not escalated to CAFT/AP for further review. | | | | | | | | 2.1 Amendments to Supplier Bank Details – 13/52 matches were referred to AP and 7/52 matches to CAFT for further review, | | | | | | | | AP: Confirmation of validity of bank account changes resolved for 4/13, in progress for 9/13 | | | | | | | | CAFT: Investigations 7/7 completed without issues. | | GT Ref | Recommendation detail | Priority | Action | Status reported to Audit Committee 22nd November 2018 | Status reported to Audit Committee 31st January 2019 | Status verbally reported to Audit Committee May (GT16) and July (GT15) 2019 | |--------|------------------------|----------|--------|------------------------------------------------------|-----------------------------------------------------|---------------------------------------------------------------------| | GT16 | Duplicate banking details | Medium | Put in place controls to identify BACS and CHAPS payments made to different suppliers with the same bank account number. There was also no manual control in place to identify BACS and CHAPS payments made to different suppliers which had the same bank accounts. We recommend that this control be considered as an addition to the new Treasury Payment Procedure. | The process has been submitted and verified, however it has not been possible to test the operating effectiveness of these controls, as the control design relating to one-time vendors was not finalised in the testing period, and the e-form used to set up new suppliers within Integra was not yet live within the system. Internal audit has reviewed the process as agreed with GT, but have not yet been able to test this independently. No issues were noted with the operating effectiveness of the checks carried out over the validity of supplier details within the Treasury Payment Process. | Partly Implemented | Implemented | | | | | | | | a. Duplicate banking details (payments to different vendors with the same bank account) | | | | | | | | The New Supplier and Supplier Amendment Process which has been implemented should support mitigation of the risk of creating fraudulent/fictitious vendors in Integra (many suppliers with the same one bank account of the potential fraudster in this instance). The creation of new suppliers is now done by Vendor E-Form, is segregated and is subject to independent checks by AP prior to update in the system by ICT in line with the process. The robust process should therefore deter the creation of fictitious vendors in Integra in the first instance. Supporting detective reporting identifying where payments made to different suppliers/vendors with the same bank account details will be achieved once the software package AP Forensics has been implemented. Commissioning and implementation of the software is being overseen by the Council/Capita AP Task Group responsible for improvements in the financial control environment. | | GT Ref | Recommendation | Recommendation detail | Priority | Action | Status reported to Audit Committee 22nd November 2018 | Status reported to Audit Committee 31st January 2019 | Status verbally reported to Audit Committee May (GT16) and July (GT15) 2019 | |--------|----------------|-----------------------|----------|--------|-----------------------------------------------------|-----------------------------------------------------|---------------------------------------------------------------------| | | | | | | ce provided around the controls relating to those processes. | | for payments. We understand that procurement and implementation of the software is imminent. The first demonstration of the software has confirmed that such detective reporting will be possible | | | | | | | | | Related PDAME outcomes - refer to Part 4 for detailed findings on matches and referral findings/progress | | | | | | | | | The PDAME identifying matches relating to different vendors having a common bank account were referred to CAFT and AP for further review. | | | | | | | | | 1.2 Multiple Vendors Receiving Payments into Common Accounts – 55/101 matches referred to AP and 7/55 suppliers covering 3 bank accounts were referred to CAFT | | | | | | | | | AP: Investigations resolved no issues for 3/55, In progress 52/55 | | | | | | | | | CAFT: Investigations resolved with no issues for 4 suppliers covering 2 bank accounts, In progress for 3 suppliers covering 1 bank account. | | | | | | | | | 2.2 Multiple Vendors Sharing a Common Bank Account Referred 284 / 296 matches to AP | | GT Ref | Recommendation detail | Priority | Action | Status reported to Audit Committee 22nd November 2018 | Status reported to Audit Committee 31st January 2019 | Status verbally reported to Audit Committee May (GT16) and July (GT15) 2019 | |--------|------------------------|----------|--------|-----------------------------------------------------|-----------------------------------------------------|------------------------------------------------------------------| | | | | | and 8/296 covering 2 bank accounts to CAFT | AP: 138/284 already resolved deactivated, 146/284 in progress. | | | | | | CAFT: 8 suppliers 2 bank accounts in progress, further information has been submitted to AP for review. | | 4.3 One Time Vendors Receiving Payments into Common Accounts – CAFT have completed checks on Integra. There are some matches which remain unverified and have been escalated to AP for further review and for them to respond with any suspicions. | | b. Misuse of the One-Time-Vendors) OTV process | | There will be occasions when undertaking Council business that one-off payments to persons (OTV) may be required. | | To ensure that officers do not use the One Time Vendor process excessively to bypass the standard PO and vendor creation processes, Integra now recognises when an OTV payment is made to a bank account used for an OTV payment before. In this | | GT Ref | Recommendation detail | Priority | Action | Status reported to Audit Committee 22nd November 2018 | Status reported to Audit Committee 31st January 2019 | Status verbally reported to Audit Committee May (GT16) and July (GT15) 2019 | |--------|------------------------|----------|--------|-----------------------------------------------------|-----------------------------------------------------|---------------------------------------------------------------------|

case the OTV payment will be rejected and the supplier will then be required to be set up as a vendor in Integra as part of the Vendor Master Data. The creation of the vendor will be subject to the various independent checks referred to in GT 15 above.

Where OTV payments are paid by cheque or to different accounts, the above bank account rejection will not apply. This will be addressed by the introduction of AP Forensics which will allow the rejection of payments based on OTV payee name too. For cheque payments, in the interim, Finance, following discussion with Cash Book team, will investigate whether the CSG team responsible for producing Integra cheque runs will identify where payees paid by cheque have previously been paid by BACS or cheque.

The action is under ongoing review by the Capita/Council AP Task group responsible for improving the control environment over Council payments.

**Action:** | GT Ref | Recommendation | Recommendation detail | Priority | Action | Status reported to Audit Committee 22nd November 2018 | Status reported to Audit Committee 31st January 2019 | Status verbally reported to Audit Committee May (GT16) and July (GT15) 2019 | |--------|----------------|-----------------------|----------|--------|-----------------------------------------------------|-----------------------------------------------------|------------------------------------------------------------------| | | | | | | AP Forensics meeting all user reporting needs will be commissioned and implemented. | | | | | | | | | **Responsible officer:** Acting Head of Finance – Projects | | | | | | | | | **Head of Financial Systems, Capita** | | | | | | | | | **Target date:** 31 August 2019 | | | | | | | | | **Related PDAME outcomes - refer to Part 4 for detailed findings on matches and referral findings/progress** | | | | | | | | | 4.1 One Time Vendors (OTVs) Receiving More than One Payment – in progress, resolved for CAFT no issues (bank accounts correct in relation to suppliers) | | | | | | | | | 4.2 One Time Vendors Receiving Payments into Multiple Bank Accounts – in progress, CAFT have requested further information from AP | | |

## 2. Accounts Payable audit - Findings, Risks and Action Plan

| Ref | Finding | Risks | Risk category | Agreed action | |-----|---------|-------|---------------|---------------| | 1 | **Authorisation of purchase orders (PO)**\
Location 6 payments (Standard PO transactions)\
The Dual Authorisation for Payments over £1million Process Note V1.0 requires the dual authorisation of purchase orders over £1m. The process document referred to the quality checking as follows:\
“Quality Checks: A report will be run on a monthly basis for payments over £1million to check the requisitions have the necessary form attached.”\
We found that there was no reporting and review process as stated.\
We tested a sample of 15 payments through location 6 in Integra for which purchase orders were raised. The 3-way match of invoice, goods receipt and PO was evident, however the dual authorisation of 2 / 15 purchase orders was not attached in Integra as required by Dual Authorisation for Payments over £1million Process Note V1.0. | If planned expenditure doesn’t support the Council’s objectives or is not aligned with business needs through the lack of appropriate scrutiny and challenge, for example, if dual authorisation is not obtained for expenditure, where necessary there is a risk of misallocation of finances, budget overspends and resident dissatisfaction. | High | **Capita (non-AP):**\
a(i): A list of purchase orders raised in Integra above £1m will be provided to Council Finance monthly.\
**Responsible officer:**\
Integra team\
**Target date:** 31 October 2019\
**Council Finance**\
a(ii): Finance will ensure that the Dual Authorisation form is completed for all POs above £1m on the monthly list. Finance will ensure that the form is completed correctly in line with the Council Constitution and is attached in Integra for referral.\
**Responsible officer:**\
Acting Head of Finance – Projects\
**Target date:** 31 October 2019\
**Council Finance**\
b(i): Finance will ensure that expenditure with Staples, the supplier replacing Office Depot, is set up in Integra to follow the standard PO route, so the 3-way match of PO, Goods Receipt and invoice, with purchase | | Ref | Finding | Risks | Risk category | Agreed action | |-----|---------|-------|---------------|---------------| | | £3,556.80. We would have expected goods receipting for an invoice of this value. We tested a sample of 8 payments ranging from £50 to £3600 in 2018-19 and 2019-20. In 2/8 cases the PO was not approved by the budget manager referred to in the prevailing Financial Scheme of Delegation (FSoD). Although the transactions are low value, the finding suggests that the Integra approval workflow may potentially not be aligned with the relevant approved SoFD at all times. At the time of this report the Council’s stationery supplier was due to change to Staples from Office Depot. **Family Services authorisation limits in ControCC** In Family Services, we noted that Heads of Service were able to authorise services up to £181,302 as stated in the Family Service Financial Scheme of Delegation within the Children’s Service Scheme of Delegation in the Constitution. However, in LCS, the Family Services social care system, the Heads of Service limit for approving services was set at £250,000. This did not affect our sample tested as commitments selected were all below the £181,302 limit in the Constitution. Family Services Finance provided us with a document, “Authorising spend - what you need to know”, which they used together with the Children’s Service Scheme of Delegation and which referred to the limit of £250,000. Our initial view is that the limits set in ControCC need to be updated at the Head of Service level so that they align with the Constitution and that Finance should review the validity of the document. We have not tested the commitment cost approval levels in Mosaic, the Adults social care system, as our testing related to authorisation at the | | | | order approval in Integra in line with the Financial Scheme of Delegation. **Responsible officer:** Acting Head of Finance – Projects **Target date:** 31 October 2019 **Accounts Payable (AP)** b(ii): Thereafter, Staples invoices will be released for payment following the standard PO route, the 3-way match of invoice, goods receipt and PO. **Responsible officer:** Accounts Payable Manager, Accounts Payable, CSG **Target date:** 31 October 2019 **Council Finance** c. Finance will review the authorisation limits as stated in the “Authorising spend - what you need to know” document, governing the authorisation levels of social care management for approving cost commitments in LCS, the Family Services social care system - set in ControCC, the Family Services financial system - to ensure that they are consistent with the Council’s Constitution. Authorisation limits will be | | Ref | Finding | Risks | Risk category | Agreed action | |-----|---------|-------|---------------|---------------| | | invoice level and matching to commitments. However, a review of the position in Adults and Communities should also be undertaken to ensure that the SoFD and related limits in Mosaic are aligned. | If a payment process facilitates the circumvention of approved payment limits then there is a risk of invalid payments and financial loss. | High | Council Finance | | | | | | a.(i) The Manual upload process will be reviewed and updated to ensure clarity over when this approach is permissible for payments, so which payments may follow the manual upload process. | | | | | | (ii) The process document will be kept up to date. The related authorisation sheet will be reviewed, updated and provided to AP on a quarterly basis as a minimum. AP will be notified of changes to the authorisations immediately, for example, where | | 2. | **Manual upload process (control design and operating effectiveness)** | | | | | | There is a documented procedure for the manual upload process, the ‘Manual Upload BACS Process V1.0’. It is estimated that the money spent via this route annually is circa £100m. The payments are made in Integra in location 2. A review of the document indicated that: | | | | | | - the preamble in the process document was vague in that it stated “This method of paying suppliers is restricted to specific types of payments, and cannot be used to circumvent the standard AP procedures”, however | | | | | | | | | updated in ControCC where applicable. A similar exercise will be done confirming that limits for approving cost commitments/care packages in Mosaic for Adults and Communities are in line with the Constitution. | | | | | | **Responsible officer:** Acting Head of Finance – Projects | | | | | | **Target date:** Implemented (as per management) | | Ref | Finding | Risks | Risk category | Agreed action | |-----|---------|-------|---------------|---------------| | | the list of the ‘specific types of payments’ or the rationale as to why this method needs to be used in each case was not specified. | | | Finance become aware that authorising officers have left the Council. | | | - The Manual Upload BACS Process V1.0 (16/8/2018), paragraph 6, “Master List of Approvers Allowed to Certify” was out of date as it included leavers, for example, xxx, xxx and xxx It is not clear how this list of approvers would be updated or by whom. | | | (iii) The Manual upload process document will emphasize that authorising officer limits must align with the total value of the manual upload payment, referring specifically to the situation where the manual upload is broken down into various payments across more than one budget manager and cost centre. | | | - We are aware of a number of payments initiated on 14/9/18 via this route which were >£25k that had been authorised by someone who only had £25k limit as per this list. Therefore, the payments should not have been made by AP. | | | Responsible officer: Acting Head of Finance – Projects | | | | | | Target date: 31 October 2019 | | | | | | AP | | | | | | AP will reject manual upload requests which do not comply with the updated manual upload process above, for example, where officers authorise total payments outside their defined limits. | | | | | | Responsible officer: Accounts Payable Manager, Accounts Payable, CSG | | | | | | Target date: 31 October 2019 | | Ref | Finding | Risks | Risk category | Agreed action | |-----|---------|-------|---------------|---------------| | 3. | **Duplicate payments**<br>We tested for duplicate payments within our sample across various Integra pay locations since Integra was implemented in 2014. None were noted.<br>Since the GT review, there is now a process in Integra for automatically identifying One Time Vendor (OTV) BACS payments that have been paid to the same bank account in the past. Such payments are rejected and assessed for inclusion of the related payee/supplier in the Integra Master Vendor List to prevent misuse of the OTV payment route by Services.<br>Crystal reporting introduced in September 2018 identifies “fuzzy matches” around supplier number, invoice reference, value and date on a daily basis for potential duplicate payments – refer to Part 3 (Appendix 5) follow-up of past audits – AP 2017-18 (AP4).<br>As part of this audit, we requested evidence of daily duplicate payment reviews, however CSG Management indicated that the report had only been run once when AP undertook, at the Council’s request, a one-off exercise to identify potential duplicate payments. This report was supplied to the Council along with a comment that AP were unable to fully complete this task as the data included interfaces of which AP have no input.<br>Processes to identify duplicate payments on a wider scale across Integra through the commissioning and procurement of software, AP Forensics, is in progress, however has not yet been implemented despite being discussed since 2018. Implementation is being overseen by the Council and Capita AP Task Group established to improve financial controls over | If duplicate payments are made for invoices or activities that have been paid in the past **then** there is a risk of overpayments, budget overspends and resident dissatisfaction | Medium | **Council Finance**<br>a. The implementation of software, AP Forensics (APF), will be expedited in line with Council requirements, to identify potentially duplicate payments based on a variety of agreed criteria such as value, name and bank details.<br>b. The Head of Counter Fraud Operations will be engaged as part of the implementation of the software, as a potential end user of the application.<br>c. Processes for identification, escalation and investigation, clarifying roles and responsibilities and the timing of reports will be documented and communicated.<br>c. Pending implementation of APF, Finance will arrange for the download of the last 3 years of Council payments at the Council through AP Forensics software to identify potentially duplicate payments for investigation. | **Responsible officer:** | | Ref | Finding | Risks | Risk category | Agreed action | |-----|---------|-------|---------------|---------------| | | payments. We understand that the software will allow the identification of duplicate payments through various criteria, for example, value, name and bank details, the full user requirements still to be defined. Pending implementation of AP Forensics, reports identifying duplicate payments are not being run as frequently as necessary in our view. An AP Forensics Demo exercise, involving Council Finance, was undertaken 6 August 2019 to demonstrate its functionality and capabilities. We requested input to assess whether functionality addressed areas below, relevant to AP and GT findings:

1. Robust reviews for duplicate payments on a variety of criteria
2. Identifying repeat OTVs, based on criteria other than OTV BACS payments to the same bank account (currently in place)
3. Detective reporting identifying where payments are made to different suppliers/vendors with the same bank account details, the gist of GT16
4. Detective reporting identifying payments to the same supplier with different bank accounts, so similar to the fraud. Finance confirmed that the AP Forensics tool should meet the above requirements. | If payments are not matched to supplier invoices and attached in Integra as evidence of accurate payment then there is a risk of supplier overpayments and financial loss | Medium | Acting Head of Finance – Projects liaising with Head of Financial Systems, Capita\
   Head of Counter Fraud Operations (engage with the AP Forensics implementation process as a potential end user of the software)\
   **Target date:**\
   31 October 2019 | | 4. | **Missing invoice**\
   We tested 10 invoices in location 1 in Integra (Standard POs) for the three-way match of invoice, good receipting and PO. In 1/10 (10%), the invoice (value £858k) was not attached in Integra when the audit test was done. The invoice was subsequently attached 26 June 2019, a significant period after it was cleared, 5/12/2018. We would have expected AP to reject a payment without a supporting invoice, particularly one of such a significant amount. We have reviewed to confirm that the invoice and payment were valid. | | | AP\
   The availability of supplier invoices in Integra will be monitored as part of AP reconciliation audit processes. Supplier invoices will be attached in Integra in all cases, where applicable. AP will reject payments where no invoice has been provided and refer them back to the Service. | | Ref | Finding | Risks | Risk category | Agreed action | |-----|---------|-------|---------------|---------------| | | | | | | | 5. | **AP Training and development**<br>AP (CSG) | If gaps in training and development are not identified then there is a risk of processing errors, processes not being followed and payments not being rejected where necessary. | Medium | **AP**<br>Evidence of AP training and development relevant to AP payment processing will be provided for Internal Audit review. AP management will review current training plans and will respond with a proposal for review | | | CSG Management indicated that a programme of training and development existed for the CSG AP team. The programme involved AP officers completing an assessment in which they recorded their understanding of various related procedure documents. Gaps noted in what they recorded informed their training. | | | **Responsible officer:**<br>Accounts Payable Manager, Accounts Payable, CSG<br>**Target date:**<br>31 October 2019 | | | We do not have an issue on the design of the process. Evidence of its operation, for example, the courses assessed, how evaluated and the resulting training identified had been requested by Internal Audit, however at the time of this report had not been provided for our review. | | | **Responsible officer:**<br>Accounts Payable Manager, Accounts Payable, CSG<br>**Target date:**<br>31 October 2019 | | | Internal Audit has right of access to all records governing the Council operations in terms of the Financial Regulations of the Constitution. | | | **Responsible officer:**<br>Accounts Payable Team Leader, CSG<br>**Target date:**<br>31 October 2019 | | | We found that new starters in Council Finance 1 January to date had attended mandatory Integra training which included AP related courses. | | | **Responsible officer:**<br>Accounts Payable Manager, Accounts Payable, CSG<br>**Target date:**<br>31 October 2019 | | Ref | Finding | Risks | Risk category | Agreed action | |-----|---------|-------|---------------|---------------| | 6. | **Documented AP Procedures**<br>a. The following documents relevant to AP processing were noted during the AP review:<br> - API E-Form Vendor Process V1.0" (non-PO transactions)<br> - The API Exemption List (non-PO transactions)<br> - “New Supplier and Supplier Amendment Process V1.0" (non-PO and PO transactions)<br> - the Integra User Guide (PO transactions)<br>We reviewed 14 Intranet procedures relevant to AP – refer to Appendix 4 for detailed review, findings as follows:<br> - 10/14 documents were out of date at the date of testing (07/11/2018) and had not been reviewed or updated in more than two years.<br> - 4/14 documents had been updated in the course of 2018, but contained information which was out of date around the escalation route for AP issues and the current supplier request process.<br>b. We also noted that documents signposted within other documents were not held on the intranet. These included a Requisitions User Guide and some Integra e-forms which aren’t in use at Barnet.<br>c. The “New Supplier and Supplier Amendment Process V1.0 (16/8/2018)” Appendix 4: “Budget Managers and Superiors” was out of date, for example, it included leavers such as xxx, xxx, xxx, xxx and xxx. | If outdated AP procedure documents or procedure documents that are no longer relevant are referred to by responsible officers **then** there is a risk of processing errors, processes not being followed and payments not being rejected where necessary.<br>**If** officers are not aware of all systems interfacing with Integra which may impact AP processes meaning, for example, that relevant reconciliation processes between those systems are not applied **then** there is a risk of inaccurate | **Medium** | **Council Finance**<br>a. All AP procedures will be reviewed, updated and communicated to the relevant finance officers. The Frequently Asked Questions (FAQ) document referring to AP payment arrangements will be finalised and published.<br>b. AP process documents no longer relevant will be removed from the Intranet.<br>c. Finance will engage with the relevant Capita teams to produce flowcharts mapping all Integra interfaces with other systems, for example, Mosaic and ControCC and defining related operation,<br><br>**Note:**<br>Process documents should not include embedded documents which may be subject to change periodically, for example, budget manager lists. The documents should have links to sign | | Ref | Finding | Risks | Risk category | Agreed action | |-----|---------|-------|---------------|---------------| | d. | The Manual Upload BACS Process V1.0 (16/8/2018), paragraph 6, “Master List of Approvers Allowed to Certify” was out of date as it included leavers, for example, xxx, xxx and xxx. | payments and liabilities in Integra. | posted documents which are also available on the Intranet. | Responsible officer: Acting Head of Finance – Projects, liaising with Capita officers where necessary. Target date: 31 October 2019 | | e. | We were unable locate a document mapping all systems interfacing with Integra, specifically impacting AP. We satisfactorily tested interface reconciliations between Integra and Mosaic - the Adults Social Care system - and ControCC - the Family Services Social Care system. We were however unclear, for example, around the Council’s Integra interfaces with other systems such as those used in Housing. | | | | | 7. | **BACS reconciliation (design)** Evidence of the daily BACS payment review processes was provided. However, although the process involved the review of payments over £35k and the Listing of BACS payments report was retained for referral, it was not clear how the process, by design, could mitigate the risk of a fraudulent change(s)/alteration(s) to the BACS file after approval, the specific risk referred to in the audit term of reference, without evidence of a formal reconciliation between BACS summary reports and the related Integra payment files. Our expectation was that BACS summary reports would be reconciled to relevant payment files after release, similar to the payroll control process where the BACS payroll file is reconciled the Net Pay system file. | If the BACS payments file is altered/changed prior to release without authorisation then there is risk of overpayments and financial loss. | Low | Council Finance The BACS file review will include a process to ensure that the BACS file has not been altered after approval, for example, a check that the amount taken from the bank account matches the amount of the approved payment run. Responsible officer: Acting Head of Finance – Projects Target date: 31 October 2019 | | Ref | Finding | Risks | Risk category | Agreed action | |-----|---------|-------|---------------|---------------| | | | | | | | | | | | | | | | | | |

### Appendix 1: Definition of risk categories and assurance levels in the Executive Summary

Note: the criteria should be treated as examples, not an exhaustive list. There may be other considerations based on context and auditor judgement.

| Risk rating | Immediate and significant action required. A finding that could cause: | |-------------|---------------------------------------------------------------------| | Critical | • Life threatening or multiple serious injuries or prolonged workplace stress. Severe impact on morale & service performance (eg mass strike actions); or | | | • Critical impact on the reputation or brand of the organisation which could threaten its future viability. Intense political and media scrutiny (i.e. front-page headlines, TV). | | | • Possible criminal or high profile civil action against the Council, members or officers; or | | | • Cessation of core activities, strategies not consistent with government’s agenda, trends show service is degraded. Failure of major projects, elected Members & Senior Directors are required to intervene; or | | | • Major financial loss, significant, material increase on project budget/cost. Statutory intervention triggered. Impact the whole Council. Critical breach in laws and regulations that could result in material fines or consequences. | | High | Action required promptly and to commence as soon as practicable where significant changes are necessary. A finding that could cause: | | | • Serious injuries or stressful experience requiring medical many workdays lost. Major impact on morale & performance of staff; or | | | • Significant impact on the reputation or brand of the organisation. Scrutiny required by external agencies, inspectorates, regulators etc. Unfavourable external media coverage. Noticeable impact on public opinion; or | | | • Significant disruption of core activities. Key targets missed, some services compromised. Management action required to overcome medium-term difficulties; or | | | • High financial loss, significant increase on project budget/cost. Service budgets exceeded. Significant breach in laws and regulations resulting in significant fines and consequences. | | Medium | A finding that could cause: | | | • Injuries or stress level requiring some medical treatment, potentially some workdays lost. Some impact on morale & performance of staff; or | | | • Moderate impact on the reputation or brand of the organisation. Scrutiny required by internal committees or internal audit to prevent escalation. Probable limited unfavourable media coverage; or | | | • Significant short-term disruption of non-core activities. Standing orders occasionally not complied with, or services do not fully meet needs. Service action will be required; or | | | • Medium financial loss, small increase on project budget/cost. Handled within the team. Moderate breach in laws and regulations resulting in fines and consequences. | | Low | A finding that could cause: | | | • Minor injuries or stress with no workdays lost or minimal medical treatment, no impact on staff morale; or | | | • Minor impact on the reputation of the organisation; or | | | • Minor errors in systems/operations or processes requiring action or minor delay without impact on overall schedule; or | | | • Handled within normal day to day routines; or | | | • Minimal financial loss, minimal effect on project budget/cost. |

| Level of assurance | | |--------------------|---------------------------------------------------------------------| | Substantial | There is a sound control environment with risks to key service objectives being reasonably managed. Any deficiencies identified are not cause for major concern. Recommendations will normally only be Advice and Best Practice. | | Reasonable | An adequate control framework is in place but there are weaknesses which may put some service objectives at risk. There are Medium priority recommendations indicating weaknesses but these do not undermine the system’s overall integrity. Any Critical recommendation will prevent this assessment, and any High recommendations would need to be mitigated by significant strengths elsewhere. | | Limited | There are a number of significant control weaknesses which could put the achievement of key service objectives at risk and result in error, fraud, loss or reputational damage. There are High recommendations indicating significant failings. Any Critical recommendations would need to be mitigated by significant strengths elsewhere. | | No | There are fundamental weaknesses in the control environment which jeopardise the achievement of key service objectives and could lead to significant risk of error, fraud, loss or reputational damage being suffered. | Appendix 2 – Analysis of findings

| Area | Critical | High | Medium | Low | Total | |--------------------|----------|------|--------|-----|-------| | | D | OE | D | OE | D | OE | D | OE | | | Accounts Payable | - | - | 1 | 1 | - | 4 | 1 | - | 7 | | Total | - | - | 1 | 1 | - | 4 | 1 | - | 7 |

Key:

- Control Design Issue (D) – There is no control in place or the design of the control in place is not sufficient to mitigate the potential risks in this area.
- Operating Effectiveness Issue (OE) – Control design is adequate, however the control is not operating as intended resulting in potential risks arising in this area.

Timetable

| Terms of reference agreed: | Fieldwork commenced: | Fieldwork completed: | Draft report issued: | Management comments received: | Final report issued: | |---------------------------|----------------------|----------------------|----------------------|-------------------------------|---------------------| | 14 August 2018 | 03 September 2018 | 25 July 2019 | 12 August 2019 | 22 August 2019 / 3 September 2019 / 4 September 2019 (AP) Various responses 13 August 2019 – 23 August 2019 / 3 September 2019 (Council Finance) 17 September 2019 (Exit meeting) | 01 October 2019 |

## Appendix 3 – Identified controls

| Area | Objective | Risks | Identified Controls | |--------------------|---------------------------------------------------------------------------|----------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------| | Accounts Payable | Liabilities are accurately and completely recorded in the underlying accounts | Manual posting error to the general ledger | Three-way check of invoice, goods receipting documentation and POs | | | | Automated posting errors occur between the two interfaces | An API Exemption List has been developed defining the type of payments which may bypass the standard PO process, including the expected supporting documentation and criteria, including value, which AP should expect, failing which payment will be rejected. | | | | | API E-Form Process payments specifying AP checks to supporting documentation. | | | | | AP checks of API payments to supporting documentation. | | | | | Monthly reconciliation of AP control account to AP creditors ledger, including independent review. | | | | | Reconciliations between Integra and ControCC/Mosaic interface payment files. | | | | | Council/Capita AP Task group has been set-up, responsible for improving overall financial controls relating to payment processing. | | | All liabilities are correctly valued and relate to legitimate expenditure-related transactions | Expenditure may be incurred for goods or services that have not been received and/or do not pertain to the organisation | See above | | All expenditure incurred relates to legitimate services or goods, and evidence exists to verify that these services or goods have been provided. Note: testing will cover the whole transaction lifecycle i.e. that the transaction has been appropriately raised and authorised within the delivery unit in question. | Fraudulent payments may be made by staff for unauthorised goods and services. Processing errors are not identified and remedied in time to prevent financial loss to the Council. Non-procurement payments are made without appropriate authorisation. | Three-way match of PO payments. Non-PO payments, OTV and non-OTV, are governed by communicated fit for purpose documented procedures and followed. BACS reconciliation reviews by Integra Finance involve the independent checks of payments over £35k. API E-Form payments governed by API E-Form Vendor process. Authorisation is done by the SoFD budget managers. Council/Capita AP Task group has been set-up, responsible for improving financial controls relating to payment processing. | | --- | --- | --- | | Potential duplicate payments are identified and investigated. | Duplicate payments are made resulting in financial loss. | Commissioning and implementation of AP Forensics in progress, managed by the Council/Capita AP Task group responsible for improving financial controls relating to payment processing. Existing crystal reporting of “fuzzy” matches. | | Invoices and payments relate to valid suppliers. | Fictitious suppliers have been created or duplicate suppliers have been set up. Changes to supplier details, including bank details, are erroneously or fraudulently made. Repeat suppliers are not appropriately set up as suppliers within the system. | Fit for purpose documented communicated process for creating and changing supplier details in Integra, New Supplier and Supplier Amendment Process V1.0”. The process referred to the creation of new suppliers and changing bank details. New Suppliers now requested via E-Form and follow a segregated creation process with supporting documentation. AP checks being done on new suppliers and change to bank details in line with the above process document, refer to GT 15 summary, above. OTV BACS payments made to suppliers more than once and paid to the same bank account are identified by Integra, investigated and escalated for creation as a supplier in Integra (Vendor Master Data). | | Payments are accurately made | Changes to the BACs payment runs are fraudulently made\
The migration of the BACs payment could be corrupted in transfer from one system to the other\
Suppliers are not paid or are paid late, leading to damaged supplier relationships | BACS reconciliation process involves the check of payments over £35k and the retention of the BACS files.\
There is a late payment KPI within the contract, subject to monitoring by the Performance Team.\
FI PI 33: Ninety-five per cent (95%) of local companies are paid within ten (10) Business Days and all other companies within thirty (30) Business Days: Target 95%, June 2019 (Actual: 93.7%), trend target missed\
FI PI 33b: Ninety-five per cent (95%) of all other companies within thirty (30) Business Days: Target 95%, June 2019 (Actual: 100%), trend is target achieved\
The Corporate Performance team has the residual risk of “Supplier Non-Payment” (non-or late payment) at score 8 and there is an improvement place which is being monitored.\
General controls ensuring accurate payments noted above\
Three-way check of invoice, goods receipting documentation and POs\
An API Exemption List has been developed defining the type of payments which may bypass the standard PO process, including the expected supporting documentation and criteria, including value, which AP should expect, failing which payment will be rejected.\
API E-Form Process payments specifying AP checks to supporting documentation. AP checks of API payments to supporting documentation | | Staff are aware of up to date policies and procedures in relation to Accounts Payable | Employees are not aware of the policies and procedures around the accounts payable process and therefore do not follow the correct procedure | The following documents relevant to AP processing were noted during the AP review:

- This guidance has been replaced with "API E-Form Vendor Process V1.0"
- The API Exemption List
- "New Supplier and Supplier Amendment Process V1.0"
- the Integra User Guide (PO transactions)\
  The process documents cover the non-PO and PO AP processes.\
  The AP control reconciliation process is referred to in the Control Account process document (referred to in the General Ledger audit, 2018-19) | | Accounts Payable feeder systems are clearly mapped and access to them is appropriately restricted | Payments are authorised within feeder systems which should not be authorised\
  Feeder systems are not reconciled to the AP sub-ledger and general ledger | GT15 involved the review of Mosaic/ControCC payments. Invoices are reconciled by Adults and Family Services Finance teams to authorised commitments in the relevant social care system. In Family Services, commitments are independently authorised by social care managers/Heads/Directors of Service in social care system in line with limits before transfer to ControCC, the Family Services Payment system. In Adults, the commitment costs are independently approved by senior Social Care Managers (at Panel) before commitments transfer to Mosaic for the system for paying invoices.\
  Responsibility for reconciliation between ControCC/Mosaic and Integra is clear and allocated. There was evidence that reconciliations were undertaken. | | All payments are requested and authorised in line with the Scheme of Delegation and Financial Authorisation | Payments are fraudulently or accidentally authorised by people who should not be able to authorise them | The workflow in Integra is designed to ensure that non-PO payments and purchase orders are approved by the budget manager in line with the prevailing Financial Scheme of Delegation (query raised above) | |---|---|---| | E-form design and use supports efficiencies in payment processing | If e-forms are badly designed or misused, payments may be authorised or made inappropriately and records of transactions may not be appropriately maintained. | The API E-Form and New Supplier and Supplier Amendment E-Form is referred to in related procedure documents. The process embedded checks of validity by AP. | Appendix 4 – Accounts Payable procedure documents review

AP process documents on the Intranet were reviewed to ensure that they were accurate.

| Title | Date | Comments | Status at the date of the AP draft report and action | |--------------------------------------------|----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------| | Changes to the supplier payment process | 16/10/2014 | This process is out of date, as the team responsible for processing invoices once they've been scanned by the mailroom are no longer based at Barnet and are instead based in Chichester. This page outlines the interim processes in place in 2014, and as such should be replaced with an updated supplier payment process. | Action: The process will be updated as necessary and communicated, including saving it to the Council's Intranet | | Title | Date | Comments | Status at the date of the AP draft report and action | |-------|------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------| | 2 | Integra 2 - E-Forms Guidance | 11/08/2015 The e-forms guidance references multiple e-forms which aren't used by LB Barnet staff:\
• New Vendor Request Form – Set up a new vendor on the system in order to raise PO's (this has only been available to staff since 05/11/18)\
• New Contract/Contract Variation Form – Create a new or vary an existing contract on Integra\
• Framework Order Form – Set up profiled payments for a particular vendor\
There is a section on the API e-forms which states that users need to check:\
• Does the requirement appear on the exemptions list?\
• Will the requirement be a one-off payment?\
• Can the requirement be paid by an alternative method, i.e. P-card or Purchase Order\
The API workflow is shown as USER > LINE MANAGER > PROCUREMENT > ACCOUNTS PAYABLE, which is in line with known process.\
The guidance is limited to this and telling people how to access the forms in Integra.\
The guidance has not been updated for more than three years, and does not reflect the current available e-forms. | This guidance has been replaced with "API E-Form Vendor Process V1.0" and "New Supplier and Supplier Amendment Process V1.0"\
**Action:** Process documents no longer relevant will be removed from the Intranet. | | 3 | API Debit E-Form Guidance | 11/08/2015 This is a step by step guide to using the API debit e-form, and is in line with process. However, it doesn't give any information to the user about when it is appropriate to use an API debit e-form. The guidance has not been updated for more than three years and is currently under review. | This guidance has been replaced with "API E-Form Vendor Process V1.0".\
An API Exemption list has been approved, documented and communicated to all relevant parties, including AP. | | Title | Date | Comments | Status at the date of the AP draft report and action | |-----------------------|------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------| | 4 FAQs | 03/02/2016 | This was guidance issued at the point of the 2016 relocation of the Accounts Payable service to ensure staff knew what the changes would entail. The information about the complaints procedure states that any escalation should be referred to xxx. As such, this guidance needs to be updated in the wake of his departure. | **Action:** Process documents no longer relevant will be removed from the Intranet. | | 5 Supplier Adoption | 03/02/2016 | This process is out of date and has been superseded by the supplier creation process linked below. It references a 2015/16 pilot of an e-Form within Integra, and describes the process for using this and states that the e-form will supersede paper forms as of 01/04/2016 if the pilot is successful. However, as paper forms are still in place at the date of this audit (October 2018), it does not seem that the pilot was successful. As such, this page should have been removed from the intranet at the point where it was decided that the e-form would not be used. | **Action:** The process will be updated as necessary and communicated, including saving it to the Council's Intranet. **This guidance has been replaced with “New Supplier and Supplier Amendment Process V1.0”** **Action:** Process documents no longer relevant will be removed from the Intranet. | | Title | Date | Comments | Status at the date of the AP draft report and action | |------------------------------|------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------| | 6 No PO, No Pay | 03/02/2016 | The Council's No PO, No Pay policy reflects the requirements of the Council's financial regulations around POs. The only exceptions noted are around SWIFT payments from Family Services and Adult Social Care and: - contracts under seal or documented by the Head of Legal/Director of HB Law (joint Legal Service) which do not require subsequent orders to be placed - gas, water, electricity, telephones, periodical payments and annual subscriptions - cash purchases properly defrayed from loan accounts or advances from petty cash This document does not cover other forms of no PO transactions (like those on the exempt list), and has not been updated since February 2016. | Action: The process will be updated as necessary and communicated, including saving it to the Council’s Intranet | | 7 Electronic API and Debit Notes | 03/02/2016 | This is the covering note for the guidance which was created at the point of the roll-out of the electronic API form. It states that any queries should be referred to xxx. As such, this guidance needs to be updated in the wake of his departure. | This guidance has been replaced with "API E-Form Vendor Process V1.0". An API Exemption list has been approved, documented and communicated to all relevant parties, including AP. Action: Process documents no longer relevant will be removed from the Intranet. | | Title | Date | Comments | Status at the date of the AP draft report and action | |-------------------------------------------|------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------| | 8 Vendor Set-Up E-Form Process Map | 03/02/2016 | The supplier e-form process map describes the e-form process in place for new suppliers. There are limitations with the process, as it does not include any verification of whether the supplier is a duplicate supplier. Additionally, the process was not adopted at the point where this process map was made, and until now, new supplier set-up has taken place on paper forms. This process map has not been updated since February 2016 and may therefore be out of date in the new Integra system. A new process has been instituted, and as such this may need to be re-mapped. | This guidance has been replaced with “New Supplier and Supplier Amendment Process V1.0” | | 9 New Vendor E-Form User Guide | 03/02/2016 | This is a step by step guide to using the new vendor e-form. However, the use of the new vendor e-form was not rolled out across the council at this time. The guidance has not been updated for more than three years, and a new process has been instituted for vendor set-up (see Supplier Creation below). As such, this has been superseded. | This guidance has been replaced with “New Supplier and Supplier Amendment Process V1.0” | | | | **Action**: Process documents no longer relevant will be removed from the Intranet. | | | 10 Accounts Payable - New Processes | 01/06/2018 | While this page has been recently updated, it names xxx as key contact for queries and issues and as such needs to be updated in the wake of her departure. | **Action**: The process will be updated as necessary and communicated, including saving it to the Council’s Intranet. | | 11 Supplier Creation | 02/07/2018 | This is the paper-based process for the creation of new suppliers. It was superseded by e-forms for supplier set-up on 05/11/18 | This guidance has been replaced with “New Supplier and Supplier Amendment Process V1.0” | | | | **Action**: Process documents no longer relevant will be removed from the Intranet. | | | Title | Date | Comments | Status at the date of the AP draft report and action | |------------------------------|------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------| | 12 New Vendor Form | 02/07/2018 | This is the paper-based form for the creation of new suppliers. It was superseded by e-forms for supplier set-up on 05/11/18. This guidance has been replaced with “New Supplier and Supplier Amendment Process V1.0” | | | 13 API exemptions list | 13/09/2016 | This list is not linked to on the Accounts Payable pages, and was found by searching the intranet. It is held within the Procurement pages. The Accounts Payable team at Chichester did not have access to a copy. The form states that it can be used for “small value one-off vendors”, but does not define small value. It can be assumed that this is lower than £25k, at which point a contract is required under the Contract Procedure Rules, but it’s not clear whether the cut-off is as low as £10k, the highest value at which no evidence of multiple competitive quotations is required. An API Exemption list has been approved, documented and communicated to all relevant parties, including AP. **Action:** Process documents no longer relevant will be removed from the Intranet. | | | 14 Integra FAQ 0.2 | 04/07/2018 | This document responds to FAQs. The document is out of date as it does not reflect the new supplier request process, and names xxx as a key contact for escalation. It also refers users to a **Requisitions User Guide** which is not linked to on the intranet. **Action:** The process will be updated as necessary and communicated, including saving it to the Council’s Intranet. | |

### Appendix 5: Follow-up of past audits – Accounts Payable 2017-18

| Ref | Finding | Risk rating | Recommendation | Responsible officer | Due date | Outcome of follow-up | |-----|---------|-------------|----------------|---------------------|----------|----------------------| | AP4 | Accounts Payable – Potential Duplicate Payments | High | 1) CSG Finance will investigate the introduction of third-party software or fit for purpose automated controls will be built into the system to identify, report and prevent duplicate payments. This will include identifying where attempts are made to progress duplicate invoice numbers for payment and a formal exception reporting and resolution process. | Head of Exchequer Services, CSG | 31/07/2018 | In interviews with the AP team, it was confirmed that the fuzzy match is now in place within the AP workflow, and that potential duplicates are investigated before any payments are released. We requested copies of the fuzzy match for given dates and were provided with these. We verified that the creation date of the reports matched the dates requested, and that the report included a column to record the outcome of the assessment by the AP team of whether the potential matches were real duplicates or not. We reviewed the parameters of the fuzzy match, and agreed that they are sufficient to identify potential duplicates. This meets the requirement within the audit recommendation for a fit-for-purpose automated control within the system. Discussions about the use of AP Forensics are ongoing. We were provided with evidence that a historic fuzzy report was completed for both Barnet and Cambridge Education in August 2018. This identified duplicate payments for Barnet (£11k) and for CE (£0.5k) and the recovery process has been started for these by the Accounts Payable Team. Note: AP Forensics has still not been implemented therefore we have raised this as a medium risk rated finding above, refer to paragraph 3 (Finding 3) | Complete | to possible duplications. However, a high volume of potential matches is received from the NFI making it difficult to identify any true duplicate and CAFT have found that the high number of false duplicates identified make it uneconomical to investigate these transactions. Due to the same data issues, the Accounts Payable team have not been able to perform their own review of data to identify duplicate invoices submitted for payment.

2. Working with relevant stakeholders, including Commissioning Group Finance, CAFT, CSG procurement and delivery units, a data cleanse of Integra vendor data will be performed to ensure that the data is of an appropriate quality to successfully support the automated controls (1) and also the NFI and/or other data matching exercises - including in house exercises. These actions (1) and (2) will be completed well in advance of the next NFI data uploads in September 2018.

Management were able to demonstrate that a historic exercise has been carried out by the Accounts Payable team to identify and investigate suppliers who share bank details. This exercise found 286 bank accounts which were attached to more than one supplier. An investigation was carried out into the root cause of the duplication, which revealed that a large number of these potential duplications were legitimate cases of multiple suppliers sharing a bank account (e.g. multiple family members using a single bank account), but that there were instances where supplier accounts had been duplicated. Additionally, a report was run of suppliers not used in the last 18 months. As a result of these two exercises, a list of 88 duplicate and 134 dormant suppliers to be deleted from Integra has been generated. However, no evidence was provided to show that the agreed cleansing has taken place. Management confirmed that this has now been approved and stated that a data cleansing exercise will be carried out as soon as possible.

We have seen evidence that the NFI data upload took place on 18/10/18. As a result, this data cleansing exercise will be too late to influence the efficiency of the NFI data matching exercise.

| AP7 | BACs Reconciliation | Control operating effectiveness – High risk | High | 1) We will retain evidence of the preparation of each BACS run to ensure that there is Head of Exchequer Services, CSG | 30/04/2018 | We have reviewed a process note, which demonstrates that the Operational Team in CSG Finance receives an e-mail from Integra Team at Capita Local Government Services advising that the PRL610 (which Complete | were found. Each BACS run is prepared by the AP team and then sent to the Capita Group Payments team who confirm the total amount paid by email. While management were able to provide the confirmation emails from Capita, they were not able to provide us with evidence of the preparation of the BACS report or evidence that the BACS amount has been agreed to the confirmation email so we have been unable to confirm appropriate segregation of duties.

an audit trail to demonstrate appropriate segregation of duties.

is the BACS run) has been run and is ready to check. A member of the Operational Team runs a report showing the total BACS run and another showing payments to suppliers which include invoices over £35k. The invoices over £35k are printed and both reports are given to one of the approved signatories in CSG Finance to check and sign. The Operational Team then reply to Integra Team at Capita Local Government Services advising that the BACS has been checked and is ok to process. A copy of the BACS report is printed, signed and then retained in a folder maintained by the CSG Finance team. We reviewed evidence that this process was followed on a sample of named days and were provided with evidence that the process is operating in accordance with the process note and that supporting information is retained.

July 2018 Audit Committee update:

Management confirmed that evidence now remains within the Integra system and that there is inbuilt segregation of duties due to the separate teams that are involved in file transmission. Additionally, once the Payment Production Report/Update has been run in Integra it cannot be amended.

Note: We have raised a low risk rated action for BACS reconciliation above, paragraph 3 Finding 7. | AP8 | **Policies, Procedures and Process notes**\
All policies and procedures are held in hard copy within a physical folder within the AP team work area at the Council. The majority of Accounts Payable processing is undertaken remotely in Sussex and Darlington; management should ensure all policies and procedures are uploaded to an appropriate shared drive so employees have remote access to all relevant documents. | **Medium** | 1) We will ensure that up to date procedure and process documents are made available to all relevant CSG and Capita staff. | **Head of Exchequer Services, CSG** | **31/03/2018** | Key Accounts Payable and Treasury processes have been through an extensive update and approval process in 2018. These are:

- Treasury Payment Process
- Manual Uploads for BACS Payments
- New Supplier and Supplier Amendments
- API process\
  The documents have been shared with staff as they have gone live, and as such, this action is deemed complete.

**Note:** We have raised a medium risk rated action for the review and update of policies and procedures above, paragraph 3, Finding 6, as some procedures are out of date at the date of the draft report. | **Complete** | Appendix 6.1: Outcome of detailed testing from ‘Payments Data Analytics and Matching Exercises’ (PDAME), reported in February 2019: | ToR ref | Test name | Data Analysis exceptions | Summary of testing | Referred to AP | Referred to CAFT | Agreed Action September 2019 | |--------|---------------------------------------------------------------------------|--------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|-----------------|-----------------------------| | 1.1 | Vendors Receiving Payments into Multiple Bank Accounts (excluding one-time vendor supplier codes, where this is expected) | 291 of 4758 unique vendor numbers (6.1%) | Manual review of all transactions carried out, which identified that all changes of account number have been correctly identified through the testing for 2.1 (see below). The remaining items identified for review are due to changes to sort code. These changes are part of a national exercise where major banks have changed sort codes to ringfence business from personal banking. We used an online sort code checker to verify that where the first two digits of the sort code (the bank identifier) were not the same, these were still the same entities. [https://www.sortcodes.co.uk/checker.html](https://www.sortcodes.co.uk/checker.html) | N/A - all changes are sort code changes and in line with expectations. | N/A - no changes need to be referred to CAFT which haven't already been referred under 2.1. | N/A | | 1.2 | Multiple Vendors Receiving Payments into Common Accounts | 101 of 6515 unique vendor numbers (1.6%) | Manual review carried out to verify whether multiple suppliers using the same bank accounts is appropriate.\
**AP**\
55 potentially duplicate suppliers sharing 27 bank accounts have been referred to AP for further investigation and deletion if found to be genuine duplicates.\
**CAFT**\
Where suppliers who do not have any clear link are identified, refer to CAFT for further investigation in case accounts are fraudulent. CAFT to verify the 55 potential duplicate suppliers across 27 bank accounts\
Resolved: 3/55 suppliers de-activated in Integra\
In progress: 52/55\
7 suppliers across 3 bank accounts\
a. Resolved (no fraud implications), 2 bank accounts covering 4 suppliers\
b. In progress: For 1 bank account covering 3 suppliers, below, request sent to AP for further information, awaiting response: | AP to resolve for deletion, where applicable, the remaining 52 matches. | AP to respond to further request for information from CAFT in relation to the one | | ToR ref | Test name | Data Analysis exceptions | Summary of testing | Referred to AP | Referred to CAFT | Agreed Action September 2019 | |---------|-----------|--------------------------|--------------------|---------------|-----------------|-----------------------------| | 1.3 | Vendors Receiving Payments into Bank Accounts Linked with Council or Capita Employees\* | 2 of 6515 unique bank account numbers (0.01%) | Payments relate to fostering and adoption. | N/A | Payments to 2 bank accounts to confirm that two employees are foster carers/adopters and therefore entitled to ongoing payments. CAFT have completed investigation – no issues noted | N/A | | 2.1 | Amendments to Supplier Bank Details | 52 of 306 changes to | Manual review of all exceptions carried out. CAFT | Amendments to bank | Amendments to bank accounts for 7 suppliers | AP to confirm that changes | | ToR ref | Test name | Data Analysis exceptions | Summary of testing | Referred to AP | Referred to CAFT | Agreed Action September 2019 | |---------|-----------|--------------------------|--------------------|---------------|----------------|-----------------------------| | | bank accounts details (17.0%) | Referred 7 suppliers with temporary bank account changes, where payments were made, to CAFT to confirm that they were to accounts held by the individuals/organisations linked with them. AP Where there was no supporting documentation demonstrating that this is a valid change that has been requested by the supplier (totalling 24 bank detail changes), AP asked to confirm directly with the 13 suppliers that the current bank details in the system are correct. | accounts for 13 Suppliers a. Amendments to bank details for 4/13 resolved as correct by AP. b. Confirmation by AP that changes to bank details were correct for 9/13 suppliers still in progress. | a. Resolved: Amendments to bank details of 7/7 suppliers considered valid and non-fraudulent | to bank details for 9/13 suppliers are correct in Integra. Responsible officer: Accounts Payable Manager, Accounts Payable, CSG Target date: 1 October 2019 | | 2.2 | Multiple Vendors Sharing a Common Bank Account | 296 of 11,318 distinct supplier numbers in master data (2.6%) | All bank accounts shared by 3 or more vendors were reviewed in detail including a review of payments made in the period. For all bank accounts with 2 suppliers, names/addresses were reviewed to assess whether reasonable. The volume of such suppliers makes it not practical to review them at transaction level if there’s a clear link by name or address between them. | Referred 284 potential duplicate or dormant suppliers who should be made inactive. | Referred 8 suppliers across 2 bank accounts, 6 vendors share one account and 2 vendors share one account. a. 8 suppliers across 2 bank | AP AP to confirm that deactivation where appropriate for 146/284 vendors sharing | | ToR ref | Test name | Data Analysis exceptions | Summary of testing | Referred to AP | Referred to CAFT | Agreed Action September 2019 | |---------|-----------|--------------------------|--------------------|---------------|----------------|-----------------------------| | | | | AP | a. 138/284 already deactivated. | accounts in progress. CAFT have requested further information from AP, Investigations cannot continue until this is received | common bank accounts. AP to respond to further request for information from CAFT in relation to two outstanding bank accounts. | | | | | CAFT | b. 146/284 in progress. Final queries. | | Responsible officer: Accounts Payable Manager, Accounts Payable, CSG | | | | | | | | Target date: 1 October 2019 | | 2.3 | Multiple Vendors Sharing one or more Email Addresses/Telephone Numbers | 3140 (email addresses) and 2586 (telephone numbers) of 11,318 distinct supplier numbers in master data (27.7% and | Based on an initial review of the outputs of this test, the majority of shared email addresses were generic emails at companies and there was a clear link between the suppliers sharing contact details. There were no indications that an investigation of shared contact details would provide additional information on top of the testing carried out on 1.2 and 2.2, where vendors shared bank accounts. | N/A | N/A | N/A | | ToR ref | Test name | Data Analysis exceptions | Summary of testing | Referred to AP | Referred to CAFT | Agreed Action September 2019 | |---------|-----------|--------------------------|--------------------|---------------|-----------------|-----------------------------| | 3.1 | Vendors Sharing Either: Bank Accounts, Email Addresses or Telephone Numbers with Council or Capita Employees (On Transactional Data)\* | 198 of 4761 vendor numbers (4.2%) | Any false matches (i.e. Building Society paying in accounts shared by multiple vendors/staff) were removed. **AP** 12 suppliers were identified as also being employees or sharing bank accounts with employees but had not been paid through this route since 2016 (at the latest) or had not been paid at all. To minimise the risk of fraudulent activity, these dormant suppliers should be deactivated in Integra. **CAFT** Payments were reviewed to assess whether they should be investigated further by CAFT. One vendor was referred to CAFT for them to verify that the payee is a care leaver. | 12 supplier matches 12/12 resolved no issues | 1 supplier match / to verify with originating service that payments made to the one vendor are legitimate due to them being a care leaver. Resolved no issues | N/A | | 4.1 | One Time Vendors (OTVs) Receiving | 389 of 2919 OTV | Of the 389 ‘OTVs’ receiving multiple payments, the number of repeat payments were RAG rated as follows: | 389 matches | 389 matches a. 389 /389 resolved – covered | **AP** AP to confirm which matches have been set | | ToR ref | Test name | Data Analysis exceptions | Summary of testing | Referred to AP | Referred to CAFT | Agreed Action September 2019 | |---------|-----------|--------------------------|--------------------|---------------|----------------|-----------------------------| | | More than One Payment transactions (13.3%) | | | | | | | | | More than 6 | 33 | | | | | | | Between 3 and 5 | 112 | | | | | | | 2 | 244 | | | | | | | Total | 389 | | | |

Internal Audit work on GT15 confirmed that at the time there were no controls in place to prevent repeat one-time vendor transactions or to verify the validity of OTV payee bank details.

**AP**

AP asked to confirm which of the 389 ‘OTVs’ have now been set up as suppliers.

**CAFT**

CAFT to review 389 matches, checking for any names already known to CAFT and that related bank accounts do belong to the same supplier.

CAFT to review the outcome of the AP analysis (i.e. which ‘OTVs’ have not yet been set up as a supplier which involves more stringent controls).

No feedback at the date of the draft report.

in 4.3. – no issues, for example OTV, that were identified as having two names to one account were checked and have links so no issues.

Some fraudulent payments that CAFT were already aware of as part of different Fraud investigation show up in this match.

up as suppliers and escalate related suspicious activity to CAFT where applicable.

**Responsible officer:** Accounts Payable Manager, Accounts Payable, CSG

**Target date:** 1 October 2019 | ToR ref | Test name | Data Analysis exceptions | Summary of testing | Referred to AP | Referred to CAFT | Agreed Action September 2019 | |---------|-----------|--------------------------|--------------------|---------------|----------------|-----------------------------| | 4.2 | One Time Vendors Receiving Payments into Multiple Bank Accounts | 96 of 2152 unique bank accounts receiving payments (4.5%) | Of 96 unique bank accounts used, Internal Audit (IA) reviewed a sample of 44 (46%) and 52 (54%) were not reviewed. 22 (50%) were due to an inputting error having been made (e.g. an incorrect digit in a bank account number). We confirmed that no successful invalid payments had been made as a result. **AP** 8 (18%) were referred to AP to confirm that invalid payments were not made (totalling £3,996 in value). AP were able to provide assurance over £325 of this amount but for the remaining three payments ‘All payments were done via a OTV & were processed as API's / pre-authorised payments. AP not advised of any BACS rejects’ For 52 bank accounts not checked by IA, AP asked to provide any information available from when vendors were set up. **CAFT** 8/8 referred to AP, above, were also referred to CAFT to confirm that the accounts belonged to the same payee. CAFT to review the outcome of the AP analysis (i.e. any supporting documents from when ‘OTVs’ were set up). | 8 bank accounts 52 bank accounts not checked by IA a. Matches relating to 8 bank accounts covering £325 / £3,996 (8%) resolved – no issues as to validity of payments (2 bank accounts), remaining 6 bank accounts referred to CAFT b. Matches relating to 52 bank accounts | 72 bank accounts referred to CAFT consisting of 20 reviewed as part of the sample 44 and 52 not part of the sample reviewed by Internal Audit. a. OTV payments to 9/72 bank accounts resolved no issues. Further 5 already known to be Fraudulent as part of on-going CAFT investigation b. OTV payments covering remaining 58 bank accounts may need to be checked pending AP response if any raise suspicions of Fraud | **AP** AP to complete the review of 52 matches **Responsible officer:** Accounts Payable Manager, Accounts Payable, CSG **Target date:** 1 October 2019 | | ToR ref | Test name | Data Analysis exceptions | Summary of testing | Referred to AP | Referred to CAFT | Agreed Action September 2019 | |---------|-----------|--------------------------|--------------------|---------------|-----------------|-----------------------------| | | | | If there is no evidence via that route, then CAFT to consider use of the POCA powers and if possible/practical, for example, under a financial investigation, to obtain relevant information. 14 (32%) were referred to CAFT to confirm that the accounts belonged to the same payee. The remaining 52 unique bank accounts used, which were not reviewed by Internal Audit in detail, were referred to CAFT to confirm that the accounts belonged to the same payee. | CAFT requested further information from AP. Explanation to be provided as to why one supplier has more than one account. To provide evidence for each supplier as Integra does not show invoices. | N/A | 77 bank accounts shared by 260 OTVs reviewed\
a. Resolved no issues 56/77 - links between vendors with different names were established, for example an individual OTV was a director of the related company OTV, so having the same bank account for each was considered satisfactory. | AP\
AP to complete the review of remaining 13 bank accounts and escalate any suspicions to CAFT.\
Responsible officer: Accounts Payable Manager, Accounts Payable, CSG\
Target date: | | 4.3 | One Time Vendors Receiving Payments into Common Accounts | 398 of 2152 unique bank accounts receiving payments (18.5%) | Matches were reviewed and excluded those clearly to the same vendor (i.e. minor spelling differences, shared family name, acronym used instead of full business name). CAFT\
The remainder 77/398 bank accounts relating to 260 OTVs were referred to CAFT for investigation, these include some names that were previously known to CAFT. | N/A | 77 bank accounts shared by 260 OTVs reviewed\
a. Resolved no issues 56/77 - links between vendors with different names were established, for example an individual OTV was a director of the related company OTV, so having the same bank account for each was considered satisfactory. | AP\
AP to complete the review of remaining 13 bank accounts and escalate any suspicions to CAFT.\
Responsible officer: Accounts Payable Manager, Accounts Payable, CSG\
Target date: | | ToR ref | Test name | Data Analysis exceptions | Summary of testing | Referred to AP | Referred to CAFT | Agreed Action September 2019 | |---------|-----------|--------------------------|--------------------|---------------|-----------------|-----------------------------| | | | | | | b. 7/77 – Already known to be fraudulent as part of an ongoing Fraud investigation | 1 October 2019 | | | | | | | c. 1/77 - one transaction appears to have been paid to a different supplier in error. This has been reported to AP | | | | | | | | d. 13/77 – The majority are unexplained and need to be explained by Finance as to why there are several names against one account (for example Barnet Homes bank account has several suppliers). CAFT have completed checks on Integra. There are some matches which remain | | | ToR ref | Test name | Data Analysis exceptions | Summary of testing | Referred to AP | Referred to CAFT | Agreed Action September 2019 | |---------|-----------|--------------------------|--------------------|---------------|-----------------|-----------------------------| | | | | | | | unverified and have been escalated to AP for further review and for them to respond with any suspicions. | | 4.4 | One Time Vendors Receiving Payments into Bank Accounts Linked with Council or Capita Employees\* | 26 of 2152 unique bank accounts receiving payments (1.2%) | All payments were reviewed for reasonableness. 16/26 Payments which required further investigation were referred to CAFT. | N/A | 16 matches investigated Resolved 16/16 – no issues, mainly for verification of season ticket repayments and council tenancies, | N/A |

\*Capita employee data not received and therefore not yet performed. Appendix 6.2 Observations from Payments Data Analytics and Matching Exercises’ reported in February 2019. As part of the PDAME, the following system observations were noted which if implemented could potentially improve financial processes. Our view is that these observations must be considered by officers with the appropriate expertise for potential current and future upgrades to Integra and related processes. | Agreed Action | Responsible Officer | Target Date | |------------------------------------------------------------------------------|------------------------------|-------------------| | Council / CSG Finance management will review the observations as a basis for implementing changes in Integra, in current or future versions/updates based on a risk/cost/benefit analysis. | CSG/LBB AP Business Partner | 31 March 2020 | | Observations which further mitigate fraud risk will be prioritised for assessment. | | |

**Observation**

1. **Functionality to match bank transactions to the accounting system is currently underutilised**

   The Integra accounting system has the functionality to upload bank account statements into the system, which enables the matching of incoming and outgoing payments on an individual transaction level to the transactions in the accounting system. We noted that bank account statements are uploaded for only 4 out of the 28 accounts we looked at and that this functionality is not actively used for any of the accounts. Utilising this functionality could make the performance of the bank account reconciliations more efficient and effective and provides assurance that transactions in the ledgers in the accounting system accurately reflect the transactions on the bank statement.

2. **Bank account reconciliations not on individual transactional level**

   Bank account reconciliations happen on a monthly basis, but are only reconciled on a total monthly movement and not at an individual transaction level. This in combination with the above finding creates the (fraud) risk that the ledgers do not accurately reflect the actual payments made as per the bank statements.

3. **Manual journals used for correction are inconsistent**

   We noted in the accounting system that correcting manual journal postings are made. These journals are not always made on the same aggregation level; some journals reflect individual transactions, some roll up to weekly, and some up to monthly corrective manual journals. Additionally, it is not always directly clear from the manual journal description the reason and source of the corrections.

4. **Integra only stores detailed information for transactions that originate in Integra**

   Transactional information like payee information (vendor ID, name and associated bank account information) is not stored for transactions that originate / are initiated outside Integra. When implementing Integra, the design decision has been made to only record the transaction in the accounting system, but not store any of the data associated to that transaction in Integra. This means that only about a quarter of the value paid out by Barnet Council can be analysed using Integra due to missing information.

5. **Payment Audit'-files only retained for 1 month** The bank transactions alone don't provide all the information required to perform the analyses in this review, therefore additional data needed to be added from Integra. All required information is captured in the 'Payment Audit'-files within Integra but currently these reports are not stored automatically and are deleted on a monthly basis as part of system housekeeping to avoid latency and slowness in using Integra (which has been a problem in the past). Capita has verbally confirmed that this has now been amended and these specific reports will be retained on an ongoing basis.

6. **A lack of centralised knowledge on where payment information is held** During our procedures, we noted on multiple occasions that there was a general lack of knowledge on what data was held on the system and where. Before the review it was believed that the transactions for the 28 non-school LBB bank accounts on Bankline were held on Integra. Only during the course of the review, it became clear that for only 15 out of 28 accounts the transactions are captured in Integra. At a very late stage it also became clear that from the 15 bank accounts held on Integra, only 1 account had the full supplier bank account details captured. It was noted that it is not easy to find where a transaction originated through Integra.

7. **Inconsistent naming convention** We noted that there are either no clear rules around naming conventions in outgoing transactions, or that these are not adhered to. For example, in the one-time vendor transactions you see a large variation in payee names for the same recipient. The table below shows an example of 3 one time vendor transactions for the same individual, same bank account\*, under varying naming conventions.

8. **Evaluate the need of all bank accounts** There are a large amount of bank accounts of which some have a small amount of transactions associated with them.

9. Misalignment of payment types between Bankline and Integra

Payment types are misaligned between Integra and Bankline. We identified that Barnet’s Bankline transactions contained 13 different payment types, however in the data from Integra there are 6 payment types used (there are a total of 10 defined in the system). Please refer to Appendix 2 for a full overview of payment types in Integra and Bankline.

When performing our reconciliation between Integra and Bankline we noted that there is a many-to-many relationship for payment types between the two systems. This means that payment types in Integra can relate to multiple payment types in Bankline and those same payment types in Bankline can relate to multiple payment types in Integra. Because of this, there was no possibility to map transaction types between systems and therefore we did not proceed using payment type in our reconciliation. For illustration purposes see the example below.

Example: Payment type A in Integra could consist of transactions of payment types X and Y from Bankline, while at the same time payment type Y can also be Integra’s type B. Therefore, there is no mapping between payment types possible which makes might not impact processing, but makes recognizing, reconciling and controlling transactions significantly more complex. Appendix 7 – Internal Audit roles and responsibilities

Limitations inherent to the internal auditor’s work

We have undertaken the review of Banking and Payment Arrangements (Accounts Payable), subject to the limitations outlined below.

Internal control

Internal control systems, no matter how well designed and operated, are affected by inherent limitations. These include the possibility of poor judgment in decision-making, human error, control processes being deliberately circumvented by employees and others, management overriding controls and the occurrence of unforeseeable circumstances.

Future periods

Our assessment of controls is for the period specified only. Historic evaluation of effectiveness is not relevant to future periods due to the risk that:

- the design of controls may become inadequate because of changes in operating environment, law, regulation or other; or
- the degree of compliance with policies and procedures may deteriorate.

Responsibilities of management and internal auditors

It is management’s responsibility to develop and maintain sound systems of risk management, internal control and governance and for the prevention and detection of irregularities and fraud. Internal audit work should not be seen as a substitute for management’s responsibilities for the design and operation of these systems.

We endeavour to plan our work so that we have a reasonable expectation of detecting significant control weaknesses and, if detected, we shall carry out additional work directed towards identification of consequent fraud or other irregularities. However, internal audit procedures alone, even when carried out with due professional care, do not guarantee that fraud will be detected.

Accordingly, our examinations as internal auditors should not be relied upon solely to disclose fraud, defalcations or other irregularities which may exist.